The Agent Skills Directory

[COMMAND_EXECUTION]: The script extensively utilizes git, gh, and npx commands to manage skill synchronization and state validation. These operations are protected by multi-layered integrity checks that verify the repository state before and after execution to detect unauthorized changes.
[EXTERNAL_DOWNLOADS]: Synchronizes data from GitHub repositories and utilizes the skills CLI via npx. Security is enforced by pinning the skills package to an exact version (1.5.22) and restricting allowed source repositories to the Fandhe-AI organization.
[DYNAMIC_EXECUTION]: Employs inline Python scripts for complex repository state signature calculation and supports the execution of a local patch checker script. The checker execution is highly secured by requiring a mandatory, user-provided hash approval (CHECKER_APPROVED_HASH) and utilizing temporary files from committed blobs to prevent TOCTOU attacks.
[INDIRECT_PROMPT_INJECTION]: Ingests and processes configuration data from skills-lock.json and remote repositories. Potential injection vectors are mitigated through strict kebab-case validation for skill names, rigorous regular expression checks for repository slugs, and comprehensive state verification logic.

sync-skills-lock